Many message-based computing systems (e.g. using eXtensible Markup Language or XML documents) include a digital signature process to secure messages (e.g., integrity, message authentication, signer authentication, etc.) sent from a sender to a recipient or receiver. In some systems, messages with signature(s) can be sent to the receiver via one or more intervening nodes. Typically, such signature schemes are used to detect changes to signed information included in the message(s). If such changes are detected in a received message, the receiver can then reject the message.
In some applications, there is a need to identify which particular element of a message is signed. One mechanism for performing this identification is to provide an identifier (ID) for each element. Another mechanism, applicable to XML documents, is to identify a subset of the XML document. For example, such a mechanism can use Qualified Names (QNames) as defined in Xpath (e.g., XML Path Language Version 1.0, Nov. 16, 1999).
However, these conventional solutions have shortcomings in some message-based systems. For example, for conventional ID-based solutions, a message may initially have a header that does not have an ID. Then a subsequent node can add an ID to the header. If the header was part of the original message's signed information, adding the ID can invalidate the signature and can also invalidate the schema of that element, which may not allow IDs as attributes. Also, adding the ID can invalidate the schema of that element (e.g. the schema may not allow IDs as attributes).
One shortcoming for conventional QName-based solutions can occur in some messaging systems that allow reordering of document parts. For example, in Simple Object Access Protocol (SOAP) (e.g., SOAP version 1.2, W3C Recommendation 24 Jun. 2003), the order of the headers in the message can be changed and, further, multiple headers can have the same QName. However, changing the order of the headers can result in errors. For example, if a simple QName-based XPath is used to identify more than one headers with that QName, the order of these headers in the original message vs. the order of these headers in the mutated message will affect the digest value of the signed reference, thereby violating the signature itself. In another example, if a QName XPath with a positional predicate is used (i.e. “the second header with such and such QName”), reordering of the headers can affect the signature. Also, adding headers with the same QName can invalidate the signature. Consequently, neither ID-based solutions nor XPath-based solutions can provide a mechanism for ensuring accurate selection of a header without signature and/or schema violations.